Caveat utilitor: Satellite phones can always be tracked

The Telegraph in London was the
first to report that Syrian government forces could have "locked on" to satellite phone
signals to launch the rocket attacks that killed journalists Marie
Colvin and Rémi
Ochlik, as well as many Syrian civilians, besides wounding dozens more including
two more international journalists. Working out of a makeshift press center in
Homs, foreign correspondents and local citizen journalists alike have been using
satellite phones to send images of attacks on civilians around the world.

Without evidence, it is impossible to know whether Syrian forces
tracked the journalists' satellite signals to target the attack. And one should
keep in mind that the building being used as a makeshift press center in Homs may
have been known to many people in the city.

Yet the consensus among technologists devoted to Internet freedom
is clear.

"Satellite phone tracking is not only possible, it's widely used
by military and security services," one human rights-oriented technologist with
experience training citizen activists in Syria told CPJ.

Jacob Appelbaum, a technologist associated with the Internet
circumvention tool popular among human rights activists known as Tor, was among the first to warn journalists via @ioerror on
Twitter: "No matter what - unless you 'know' otherwise, your Satellite phone
almost certainly discloses your exact GPS location in an insecure manner."

There are at least three ways to track a satellite phone. Tracking
radio frequency emissions is one. "It is relatively simple to receive this
signal for a trained technician, " reports SaferMobile, a U.S.-based
nonprofit group dedicated to helping activists, human rights defenders and
journalists share information, in a blog this week pegged to the above attack.

Using commercially available tracking devices is another. "There
is ample technology already on the market for doing so," the Electronic
Frontier Foundation, another, San Francisco-based nonprofit organization, wrote in a
blog yesterday. Companies including the Polish firm TS2 sell monitoring
equipment to track different models of satellite phones. The Italian firm Area
SpA sold surveillance equipment to Syria last year in advance of the current
crackdown, according to Bloomberg
News and EFF.

Finally, satellite phones can be tracked through their own
built-in GPS devices or weak encryption protocols. "It is very likely that the
GPS location data is transmitted by the sat phone in the clear," reports Safer
Mobile. "Additionally and important as a side note -- aside from revealing your
location with a sat phone -- the encryption used by commercial satellite
telephone systems has been recently cracked."

So what are journalists and citizen journalists to do? In an
environment where normal Internet access is either shut down or severely
restricted, satellite phones remain a key way to transmit and report information.
For now, alternatives such as amateur radio links or -- as this
report from Syria suggests, using carrier pigeons -- are largely infeasible
replacements.

Technologists with experience operating in hostile environments
tell CPJ that one should use a satellite phone in such situations only with
strict radio discipline:

-Avoid using a satellite phone (or any radio frequency based
device) from the same position more than once.

-Avoid using a satellite phone or similar device from a location
that cannot be easily evacuated in case of attack.

-Keep the maximum length of any transmission to 10 minutes at most,
then cease transmitting and change location as soon as possible.

-Avoid having multiple parties transmit from the same location,
i.e. a central media center may be too dangerous to operate in a place like
Homs, Syria.

Comments

To clarify: why is everybody in Syria (as was the case in Libya) convinced that Inmarsat sat phones can't be traced ?
I knew thurayas could be traced, but am always hearing Inmarsat can't. Could someone with real tech knowledge answer this, cause I and many others are using the Inmarsat?
many thanks
Alfred

If possible, use the satellite phone remotely, i.e. have a remote audio connection to the location from where the satellite phone transmits, so you can keep people out of harms way, and just endanger the hardware.

Alfred -- as I understand it, there's not much difference between the two in terms of traceability. They both use GMR, although aimed at different satellites. Thuraya are known to actually transmit their location (ie a message that you can listen to, that describes exactly where the source is); that's a lot easier than trying to triangulate on a signal. But I suspect the Thuraya flaws get more publicity just because they were so egregious.

No-one is going to say that an Inmarsat phone is untraceable -- you're a big, anomalous radio signal either way.

Hi, I posted this yesterday, but it appears to have not made it through moderation, so in case it was spammed or deleted I'm posting my comment again!

This was sent in reply to Frank Smyth directly, but I'm realizing it makes sense to publish here also:

1. the use of the term "locked on" is misleading, because it gives a sort of sci-fi all-seeing eye impression to the technology, similar to "heat-seeking missiles" which is misleading enough to be dangerous, if not outright false. RF triangulation generally involves multiple RF receivers making something of a "best guess" distinction for targeting-of course some technology is better than others.

2. "tracking" is not the same as "locating" or "triangulating" part of the reason cellphone tracking is so easy is that the cellphone is *constantly* updating its location by sending a signal and orienting itself based on the available cell towers (in fact a cellphone does its own kind of triangulation, but in reverse, attempting to locate the best signal as well as preferring towers that are on its "network")

3. Jacob Appelbaum is a very smart guy, but something of a security ultra shall we say, someone who generally believes that we should suspect the worst. He is correct, however worst-case paranoia serves primarily to paralyze rather than to inform. While your satphone *may* disclose your GPS location in an insecure manner(first difficulty), you need to have the right device to track that location(second difficulty), and you need to be able to determine the user you are looking for (third difficulty), and that user needs to have their phone deployed at the time you are looking for their particular signal (fourth difficulty).

4. The assertion by "Anonymous" that "It is very likely that the GPS location data is transmitted by the sat phone in the clear," should be recognized by any journalist as, A. possible, but B. suspicious in that there is NO citation information available, and given that we have no idea whom "Anonymous" is may be a "best guess" based on the worst-case paranoia of respected security ultras. (Do you want to be the guy telling the smartest guy in the room that, while his assertion may be true, its not necessarily relevant?).

5. I believe it is MOST likely that Marie Colvin was killed because the Syrians finally got around to targetting the "makeshift media centre" read "opposition media centre" or even "rebel media centre" and that this centre had been targeted due to a *stationary* satellite device read a VSAT which could be targeted based on a number of factors, not the least of which being visual confirmation. The bigger issue I'd like to see discussed out of this is how can journalists, their news agencies and their advocacy organizations assist them to obtain the very necessary tools to communicate in the field WITHOUT the dependence on local citizens, opposition activists, irregular combatants, or otherwise. Certainly this is a bit of wishful thinking, but how many correspondents recognized the need to circumvent observation by the US military while in Iraq or Afghanistan? Its a different need, but its going to be difficult to continue telling the story of irregular warfare if we can't come up with better means to protect ourselves while getting the story out.